Edit tour

Windows Analysis Report
https://ubc.zoom.us/j/2243567901?pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09

Overview

General Information

Sample URL:	https://ubc.zoom.us/j/2243567901?pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09
Analysis ID:	1587177
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Tries to delay execution (extensive OutputDebugStringW loop)

Contains capabilities to detect virtual machines

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Stores files to the Windows start menu directory

Tries to disable installed Antivirus / HIPS / PFW

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 7112 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6280 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1920,i,10911561372752407795,12782074899666422176,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7252 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5868 --field-trial-handle=1920,i,10911561372752407795,12782074899666422176,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe (PID: 7632 cmdline: "C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe" MD5: 84928D50CA36826F9190E141AA8F2CFB)

Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe (PID: 7684 cmdline: "C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe" /normal.priviledge MD5: 84928D50CA36826F9190E141AA8F2CFB)

Installer.exe (PID: 8188 cmdline: "C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" ZInstaller --conf.mode=silent --ipc_wnd=262910 MD5: D143FF2D8254FDA992D42B9275374306)

Installer.exe (PID: 6360 cmdline: "C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" /addfwexception --bin_home="C:\Users\user\AppData\Roaming\Zoom\bin" MD5: D143FF2D8254FDA992D42B9275374306)

Zoom.exe (PID: 7636 cmdline: "C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe" "--url=zoommtg://win.launch?h.domain=ubc.zoom.us&h.path=join&confid=dXNzPWNxa2x0dFJLV2NmVm95Rm9XRTIyWnpwaWo1dVpsZl9jVExhSUc0b2YwR1huZ2VOLUNhY21FdmtEaUt1Sks1SXBMMi1GZC05MnZobjVxUmoxaDhkT3gwbW9Ld1hGMEM5UzZSWXhpYmZxZ3pxSHRrQ25laUZlSXloaEZwRUJuT3A1VEtuZDlDSEJqeW0wRHhhS2pQUFR2U240ZEFmRFhyQUZfcVFycUEuTE9wZzF4dUZuN3ZtQUhfdyZ0aWQ9ZDg4NjA2OWJiZTU1NGMyNjlhMDA2NWMzOGUyNDRlNjA%3D&mcv=0.92.11227.0929&stype=0&zc=0&browser=chrome&action=join&confno=2243567901&pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09" MD5: F481F25C82B2CD0302544AAB09BD7884)

Zoom.exe (PID: 4348 cmdline: "C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe" --action=join --runaszvideo=TRUE MD5: F481F25C82B2CD0302544AAB09BD7884)

zm4221.tmp (PID: 7552 cmdline: "C:\Users\user\AppData\Local\Temp\zm4221.tmp" -DAF8C715436E44649F1312698287E6A5=C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe MD5: 84928D50CA36826F9190E141AA8F2CFB)

Zoom.exe (PID: 4060 cmdline: "C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe" "--url=zoommtg://ubc.zoom.us/join?action=join&confno=2243567901&pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09&confid=dXRpZD1VVElEX2MyZWZmOTYwYmQ5NzQyZmJiMDU5YWI0OTJlNGI1ZDcwJnVzcz1jcWtsdHRSS1djZlZveUZvV0UyMlp6cGlqNXVabGZfY1RMYUlHNG9mMEdYbmdlTi1DYWNtRXZrRGlLdUpLNUlwTDItRmQtOTJ2aG41cVJqMWg4ZE94MG1vS3dYRjBDOVM2Ull4aWJmcWd6cUh0a0NuZWlGZUl5aGhGcEVCbk9wNVRLbmQ5Q0hCanltMER4YUtqUFBUdlNuNGRBZkRYckFGX3FRcnFBLkxPcGcxeHVGbjd2bUFIX3cmdGlkPWQ4ODYwNjliYmU1NTRjMjY5YTAwNjVjMzhlMjQ0ZTYw&browser=chrome" MD5: F481F25C82B2CD0302544AAB09BD7884)

chrome.exe (PID: 4540 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ubc.zoom.us/j/2243567901?pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rundll32.exe (PID: 8080 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

notepad.exe (PID: 8124 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Downloads\zopener_8a4800ea0a3f43f4bafd7706c1a4e7ee.log MD5: 27F71B12CB585541885A31BE22F61C83)

cleanup

Sigma Signatures

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: , EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe, ProcessId: 8188, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\Zoom 3.6.0

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: https://ubc.zoom.us/j/2243567901?pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09#success	HTTP Parser: No favicon
Source: https://ubc.zoom.us/j/2243567901?pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09#success	HTTP Parser: No favicon

Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION Zoom.exe

Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX

Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe

File created: C:\Users\user\AppData\Roaming\Zoom\installer.txt

Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File created: C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\directui_license.txt
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File created: C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\duilib_license.txt
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File created: C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\nanosvg_LICENSE.txt
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File created: C:\Users\user\AppData\Roaming\Zoom\tmp_bin\directui_license.txt
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File created: C:\Users\user\AppData\Roaming\Zoom\tmp_bin\duilib_license.txt
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File created: C:\Users\user\AppData\Roaming\Zoom\tmp_bin\nanosvg_LICENSE.txt

Source: unknown	HTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 170.114.52.10:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 170.114.46.1:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:61319 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Zoom\uninstall\Installer.exe
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Zoom\uninstall
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File opened: C:\Users\user\AppData\Roaming\Zoom
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File opened: C:\Users\user\AppData

Source: global traffic	TCP traffic: 192.168.2.16:61317 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:61317 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:61317 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:61317 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:61317 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:61317 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.16:61317 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 23.56.254.164
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: ubc.zoom.us
Source: global traffic	DNS traffic detected: DNS query: st2.zoom.us
Source: global traffic	DNS traffic detected: DNS query: us01ccistatic.zoom.us
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: log-gateway.zoom.us
Source: global traffic	DNS traffic detected: DNS query: ca01st3.zoom.us
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: geolocation.onetrust.com
Source: global traffic	DNS traffic detected: DNS query: cdn.zoom.us
Source: global traffic	DNS traffic detected: DNS query: zoom.us
Source: global traffic	DNS traffic detected: DNS query: www3.zoom.us
Source: global traffic	DNS traffic detected: DNS query: st1.zoom.us
Source: global traffic	DNS traffic detected: DNS query: ca01st1.zoom.us
Source: global traffic	DNS traffic detected: DNS query: ca01st2.zoom.us

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61347
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61349
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61343
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61345
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61330 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61352
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 61348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 61337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61319
Source: unknown	Network traffic detected: HTTP traffic on port 61341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61325
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61327
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61329
Source: unknown	Network traffic detected: HTTP traffic on port 61319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61323
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61324
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61338
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61339
Source: unknown	Network traffic detected: HTTP traffic on port 61347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61335

Source: unknown	HTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.56.254.164:443 -> 192.168.2.16:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 170.114.52.10:443 -> 192.168.2.16:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 170.114.46.1:443 -> 192.168.2.16:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:61319 version: TLS 1.2

Source: classification engine

Classification label: mal52.evad.win@38/229@42/130

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\C:/Users/user/Downloads/zopener_8a4800ea0a3f43f4bafd7706c1a4e7ee.log
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	Mutant created: \Sessions\1\BaseNamedObjects\zoom.us Installer Mutex 1.0.0.0
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\ZOpener.user.launcher

Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe

File created: C:\Users\user\AppData\Local\Temp\zm4221.tmp

Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Process where name = "Zoom.exe"
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed,Manufacturer,Name,Version,Description,CurrentClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Process where name = "Zoom.exe"
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed,Manufacturer,Name,Version,Description,CurrentClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Process where name = "Zoom.exe"
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed,Manufacturer,Name,Version,Description,CurrentClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed,Manufacturer,Name,Version,Description,CurrentClockSpeed from Win32_Processor

Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1920,i,10911561372752407795,12782074899666422176,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ubc.zoom.us/j/2243567901?pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5868 --field-trial-handle=1920,i,10911561372752407795,12782074899666422176,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1920,i,10911561372752407795,12782074899666422176,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5868 --field-trial-handle=1920,i,10911561372752407795,12782074899666422176,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe "C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe"
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Process created: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe "C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe" /normal.priviledge
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe "C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\Downloads\zopener_8a4800ea0a3f43f4bafd7706c1a4e7ee.log
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Process created: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe "C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" ZInstaller --conf.mode=silent --ipc_wnd=262910
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Process created: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe "C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" ZInstaller --conf.mode=silent --ipc_wnd=262910
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	Process created: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe "C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe" /addfwexception --bin_home="C:\Users\user\AppData\Roaming\Zoom\bin"
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Process created: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe "C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe" "--url=zoommtg://win.launch?h.domain=ubc.zoom.us&h.path=join&confid=dXNzPWNxa2x0dFJLV2NmVm95Rm9XRTIyWnpwaWo1dVpsZl9jVExhSUc0b2YwR1huZ2VOLUNhY21FdmtEaUt1Sks1SXBMMi1GZC05MnZobjVxUmoxaDhkT3gwbW9Ld1hGMEM5UzZSWXhpYmZxZ3pxSHRrQ25laUZlSXloaEZwRUJuT3A1VEtuZDlDSEJqeW0wRHhhS2pQUFR2U240ZEFmRFhyQUZfcVFycUEuTE9wZzF4dUZuN3ZtQUhfdyZ0aWQ9ZDg4NjA2OWJiZTU1NGMyNjlhMDA2NWMzOGUyNDRlNjA%3D&mcv=0.92.11227.0929&stype=0&zc=0&browser=chrome&action=join&confno=2243567901&pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09"
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Process created: C:\Users\user\AppData\Local\Temp\zm4221.tmp "C:\Users\user\AppData\Local\Temp\zm4221.tmp" -DAF8C715436E44649F1312698287E6A5=C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process created: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe "C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe" --action=join --runaszvideo=TRUE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe "C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe" "--url=zoommtg://ubc.zoom.us/join?action=join&confno=2243567901&pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09&confid=dXRpZD1VVElEX2MyZWZmOTYwYmQ5NzQyZmJiMDU5YWI0OTJlNGI1ZDcwJnVzcz1jcWtsdHRSS1djZlZveUZvV0UyMlp6cGlqNXVabGZfY1RMYUlHNG9mMEdYbmdlTi1DYWNtRXZrRGlLdUpLNUlwTDItRmQtOTJ2aG41cVJqMWg4ZE94MG1vS3dYRjBDOVM2Ull4aWJmcWd6cUh0a0NuZWlGZUl5aGhGcEVCbk9wNVRLbmQ5Q0hCanltMER4YUtqUFBUdlNuNGRBZkRYckFGX3FRcnFBLkxPcGcxeHVGbjd2bUFIX3cmdGlkPWQ4ODYwNjliYmU1NTRjMjY5YTAwNjVjMzhlMjQ0ZTYw&browser=chrome"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe "C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe" "--url=zoommtg://ubc.zoom.us/join?action=join&confno=2243567901&pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09&confid=dXRpZD1VVElEX2MyZWZmOTYwYmQ5NzQyZmJiMDU5YWI0OTJlNGI1ZDcwJnVzcz1jcWtsdHRSS1djZlZveUZvV0UyMlp6cGlqNXVabGZfY1RMYUlHNG9mMEdYbmdlTi1DYWNtRXZrRGlLdUpLNUlwTDItRmQtOTJ2aG41cVJqMWg4ZE94MG1vS3dYRjBDOVM2Ull4aWJmcWd6cUh0a0NuZWlGZUl5aGhGcEVCbk9wNVRLbmQ5Q0hCanltMER4YUtqUFBUdlNuNGRBZkRYckFGX3FRcnFBLkxPcGcxeHVGbjd2bUFIX3cmdGlkPWQ4ODYwNjliYmU1NTRjMjY5YTAwNjVjMzhlMjQ0ZTYw&browser=chrome"
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Process created: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe "C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe" "--url=zoommtg://win.launch?h.domain=ubc.zoom.us&h.path=join&confid=dXNzPWNxa2x0dFJLV2NmVm95Rm9XRTIyWnpwaWo1dVpsZl9jVExhSUc0b2YwR1huZ2VOLUNhY21FdmtEaUt1Sks1SXBMMi1GZC05MnZobjVxUmoxaDhkT3gwbW9Ld1hGMEM5UzZSWXhpYmZxZ3pxSHRrQ25laUZlSXloaEZwRUJuT3A1VEtuZDlDSEJqeW0wRHhhS2pQUFR2U240ZEFmRFhyQUZfcVFycUEuTE9wZzF4dUZuN3ZtQUhfdyZ0aWQ9ZDg4NjA2OWJiZTU1NGMyNjlhMDA2NWMzOGUyNDRlNjA%3D&mcv=0.92.11227.0929&stype=0&zc=0&browser=chrome&action=join&confno=2243567901&pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09"
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Process created: C:\Users\user\AppData\Local\Temp\zm4221.tmp "C:\Users\user\AppData\Local\Temp\zm4221.tmp" -DAF8C715436E44649F1312698287E6A5=C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process created: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe "C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe" --action=join --runaszvideo=TRUE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX

Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Window / User API: threadDelayed 654
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe	Window / User API: threadDelayed 2145

Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe TID: 7632	Thread sleep count: 654 > 30
Source: C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe TID: 4404	Thread sleep count: 2145 > 30

Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll
Source: C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	File opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	231 Windows Management Instrumentation	1 Windows Service	1 Windows Service	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 Scripting	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	23 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 DLL Side-Loading	1 Modify Registry	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	133 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner
C:\Users\user\Downloads\Unconfirmed 201182.crdownload	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\tmp_bin\CmmBrowserEngine.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\tmp_bin\Cmmlib.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\tmp_bin\CptHost.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\tmp_bin\cmmbiz.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\CptControl.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\CptHost.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\CptInstall.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\CptService.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\CptShare.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\DuiLib.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\MailClient.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\UIBase.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\WebView2Loader.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\XmppDll.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\ZMDB.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\ZUI.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\ZZHostIPCSDK.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\Zoom.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\ZoomOutlookIMPlugin.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\ZoomTask.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\ZoomTelemetry.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\Zoom_launcher.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\annoter.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\asproxy.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\cares.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\libmpg123.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\libssl-3-zm.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\mcm.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\mfAdapter.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\nydus.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\reslib.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\ssb_sdk.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\tp.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\turbojpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\util.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\viper.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\viper_async_device.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zAutoUpdate.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zBusinessUIComponent.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zChatApp.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zChatUI.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zCommonChat.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zContext.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zCrashReport64.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zCrashReport64.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zData.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zEventTracker.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zKBCrypto.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zLooper.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zMailRes.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zMailUI.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zMeshNetAgent.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zMsgApp.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zMsgAppCommon.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zNet.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Zoom\zoom_install_src\zNetUtils.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
ca01st1.zoom.us	170.114.45.1	true	false	unknown
edge-log-gateway-web-2f8111e8e5387748.elb.us-east-1.amazonaws.com	170.114.65.138	true	false	unknown
us01ccistatic-c.zoom.us	170.114.45.1	true	false	unknown
ca01web.zoom.us	170.114.52.10	true	false	unknown
cdn.zoom.us	170.114.46.1	true	false	high
st1.zoom.us	170.114.46.1	true	false	high
www.google.com	216.58.206.68	true	false	high
zoom.us	170.114.52.2	true	false	high
edge-log-gateway-web-158ad3d115123922.elb.us-east-2.amazonaws.com	134.224.0.55	true	false	unknown
cdn.cookielaw.org	104.18.87.42	true	false	high
geolocation.onetrust.com	104.18.32.137	true	false	high
ca01st2.zoom.us	unknown	unknown	false	unknown
ubc.zoom.us	unknown	unknown	false	unknown
log-gateway.zoom.us	unknown	unknown	false	high
us01ccistatic.zoom.us	unknown	unknown	false	high
www3.zoom.us	unknown	unknown	false	unknown
st2.zoom.us	unknown	unknown	false	high
ca01st3.zoom.us	unknown	unknown	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
134.224.0.55	edge-log-gateway-web-158ad3d115123922.elb.us-east-2.amazonaws.com	United States	3479	PEACHNET-AS1US	false
104.18.87.42	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
170.114.52.2	zoom.us	United States	22347	DORSEY-WHITNEYUS	false
134.224.0.54	unknown	United States	3479	PEACHNET-AS1US	false
144.195.5.213	unknown	United States	20221	IATACA	false
170.114.65.138	edge-log-gateway-web-2f8111e8e5387748.elb.us-east-1.amazonaws.com	United States	22347	DORSEY-WHITNEYUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
172.64.155.119	unknown	United States	13335	CLOUDFLARENETUS	false
216.58.206.35	unknown	United States	15169	GOOGLEUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.18.32.137	geolocation.onetrust.com	United States	13335	CLOUDFLARENETUS	false
144.195.4.213	unknown	United States	20221	IATACA	false
142.250.185.195	unknown	United States	15169	GOOGLEUS	false
142.251.40.174	unknown	United States	15169	GOOGLEUS	false
170.114.52.10	ca01web.zoom.us	United States	22347	DORSEY-WHITNEYUS	false
170.114.46.1	cdn.zoom.us	United States	22347	DORSEY-WHITNEYUS	false
170.114.45.1	ca01st1.zoom.us	United States	22347	DORSEY-WHITNEYUS	false
142.250.184.206	unknown	United States	15169	GOOGLEUS	false

Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: wininet.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: wldp.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: profapi.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: netutils.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: schannel.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587177
Start date and time:	2025-01-10 00:45:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://ubc.zoom.us/j/2243567901?pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	EGA enabled
Analysis Mode:	stream
Detection:	MAL
Classification:	mal52.evad.win@38/229@42/130

Process:	C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe
File Type:	Microsoft Cabinet archive data, many, 14270711 bytes, 25 files, at 0x1830 +A "zAppRes.dll" +A "zAppUI.dll", flags 0x4, ID 36432, number 1, extra bytes 6144 in head, 1139 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	14270711
Entropy (8bit):	7.999845834403855
Encrypted:	true
SSDEEP:
MD5:	8B96AB560A731158FC34B41E8AA96543
SHA1:	B03C79567779C802FBDE19CC87FA7F25663AAE93
SHA-256:	CEEDD91A8D932CCD8F3EB21776931977A5F2ACD07A6340A05D1213EF8F1AA2FA
SHA-512:	039F4EADBC00CB820AD76D900242E55D584D0C7FC2B7BA58BBCBFF9C5DFA728315478C43891D1D06947AD6DD626FF2D8556DFBB90993A59FC1B07AA4F5F1CB56
Malicious:	false
Reputation:	unknown
Preview:	MSCF............0...............P.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Users\user\Downloads\Zoom_cm_fotiZ9vvrZo4_mJGohcJr5Wi4nh-+oH9qDAdNxPgV4bAl8sJE@Ya299Uo3BvkVZYb-_ke7c3d59090895be7_.exe
File Type:	ASCII text, with very long lines (686), with CRLF line terminators
Category:	dropped
Size (bytes):	797
Entropy (8bit):	6.038297740042832
Encrypted:	false
SSDEEP:
MD5:	C695511232F0F72AF92918520073CC29
SHA1:	EF8BFF9E2C5591DD07C887F94B6C4DD8291A0344
SHA-256:	6EF8BD65F26D0996EBCCC7E8877AB570CFCD85CFBF88DAC2854007730C54C650
SHA-512:	7EB07E80364A7AFD8DEE3F9DEE4DF912C92EB9B5754BEA6BD6821CC99859C2B20727AF9401B9640523D8CF172F5D15E8D4FC6D40AC091C4C82E919506B59B882
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]..ZoneId=3..ReferrerUrl=https://ubc.zoom.us/j/2243567901?pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09..HostUrl=https://ubc.zoom.us/launch/download/L5gQryhk2uT5qCl-icb2i8qJ2bpsbC4PmZI7QYdsTbP3BI5leVREUmHdROlJf4b_t1yTtn-It0_5J3Q1s15JA-FuW3bIBig-2e3ZYHh2IlhV70b6xxKb57doXcRSrD7RjTDMQwmQFjPBjJnDIi1Lnf3wyvHDfbxwrF2tGl8TY2dgvJXQo9m4xm-kkeI6vAypk9CUASmsAFf7JHJH01s_OQAfjNUBtzAuN-DInE-X7-nEmq18goCpFQqXXsQkJt8EZPAZupTvV-7GP9oKHDchFZyQD2I30K9TWcFYTVdU8BTG0GfkEOmmi9E_LwqDvCmrwqko5dbLT2jrhoBrtYu_cfjEBwK0b9kikoiLfW-m50KprBpey7FMmaklpUi9ecaxcG6-pg9NHPqguBSXElG03ZKNYvQ12Liq_NHdRSiP92t_gmyUenXb5vhyZ_WTr4Gxlz0oMsns6Oop-EkacDLNBTs80NgLiTLAr9tZQTOmm4OLyEGbw3WVeS4ShhaJti4sN3eOxCUv6c6kU_xzXUhrulUL_YO3UlNj1A.8800UxsXksWQX2ae/meeting/9QVsJT2OBTY_vqlsXxgPZm0W3lvPE6aeiak.o9vWanpkSSZcsLCy/Zoom_launcher.exe..

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Jan 9 22:46:27 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.991439298874476
Encrypted:	false
SSDEEP:
MD5:	8A6D6CE82339F5C55EE5F307B2CC795A
SHA1:	BA4AC59A03D877F86E82B7009CCD84F938CA5020
SHA-256:	3B419D37799293B2BDA298EBCB1A8B070B944AC7C2789ABC79F2AE89A9339EF1
SHA-512:	1CDFC0CB01E3C4BC7BADB51600548004976EB0F45B87A0466BF9EF5C07ABA8A8A7186FA792AE1D0BEEB15CB2D3D0A411B17481A71957CA50EF6D4CA3141AEEC0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....FR9..b..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I)Z.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V)Z.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V)Z.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V)Z............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V)Z............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........8zM......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://ubc.zoom.us/j/2243567901?pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09

Overview

General Information

Detection

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Phishing

Bitcoin Miner

Compliance

Spreading

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\Local\Temp\ZCOMPT~1.CAB.zmdownload

C:\Users\user\AppData\Local\Temp\ZLANG~1.7Z{.zmdownload

C:\Users\user\AppData\Local\Temp\zClipsCab{EA0714D2-67CC-445D-B32E-573F045A2191}

C:\Users\user\AppData\Local\Temp\zm4221.tmp:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\352fd027c0e8f0e5.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9B5UCYSE72G18YVSEFGR.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I3C19IEW8JDUVXNE1DGC.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zoom\Uninstall Zoom Workplace.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zoom\Zoom Workplace.lnk

C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Installer.exe

C:\Users\user\AppData\Roaming\Zoom\ZoomDownload\Zoom.msi

C:\Users\user\AppData\Roaming\Zoom\bin\avformat_zm-59.dll

C:\Users\user\AppData\Roaming\Zoom\bin\language\zLang_de.dll

C:\Users\user\AppData\Roaming\Zoom\bin\language\zLang_es.dll

C:\Users\user\AppData\Roaming\Zoom\bin\language\zLang_fr.dll

C:\Users\user\AppData\Roaming\Zoom\bin\language\zLang_id.dll

C:\Users\user\AppData\Roaming\Zoom\bin\language\zLang_it.dll

C:\Users\user\AppData\Roaming\Zoom\bin\language\zLang_jp.dll

C:\Users\user\AppData\Roaming\Zoom\bin\language\zLang_korean.dll

C:\Users\user\AppData\Roaming\Zoom\bin\language\zLang_nl.dll

C:\Users\user\AppData\Roaming\Zoom\bin\language\zLang_pl.dll

C:\Users\user\AppData\Roaming\Zoom\bin\language\zLang_ptg.dll

C:\Users\user\AppData\Roaming\Zoom\bin\language\zLang_ru.dll

Windows Analysis Report
https://ubc.zoom.us/j/2243567901?pwd=ak1XbmprdFBUQnRZOWszWU91VHdyUT09

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre